Procedure

1. Install the following packages:

   # yum install realmd oddjob oddjob-mkhomedir sssd adcli krb5-workstation

2. Configure the local RHEL system with the realm join command. The realmd suite edits all required configuration files automatically. For example, for a domain named ad.example.com:

   # realm join ad.example.com

   If you do not want to use realmd, you can configure the system manually. See Manually Connecting an SSSD Client to an Active Directory Domain in the Red Hat Knowledgebase.

Procedure

1. Install the following packages:

   # yum install realmd oddjob oddjob-mkhomedir sssd adcli krb5-workstation

2. Configure the local RHEL system with ID mapping disabled using the realm join command with the --automatic-id-mapping=no option. The realmd suite edits all required configuration files automatically. For example, for a domain named ad.example.com:

   # realm join --automatic-id-mapping=no ad.example.com

3. If you already joined a domain, you can manually disable ID Mapping in SSSD:

   1. Open the /etc/sssd/sssd.conf file.
   2. In the AD domain section, add the ldap_id_mapping = false setting.

   3. Remove the SSSD caches:

      rm -f /var/lib/sss/db/*

   4. Restart SSSD:

      systemctl restart sssd

Procedure

1. Install required packages.

   # yum install sssd realmd adcli samba-common-tools oddjob oddjob-mkhomedir

2. Use realmd to join the first AD domain, addomain1.com.

   # realm join ADDOMAIN1.COM

3. Rename the system keytab to a unique name.

   # mv /etc/krb5.keytab /etc/addomain1.com.krb5.keytab

4. Use adcli to join the second AD domain, and any additional domains. Use the -K option to specify a unique path for the Kerberos keytab where host credentials will be written.

   # adcli join -D dc2.addomain2.com -K /etc/addomain2.com.krb5.keytab

5. Modify /etc/krb5.conf.

   • Add the includedir option to include SSSD configuration files.

   • Enable DNS lookups for AD Domain Controllers with the dns_lookup_kdc option.

     includedir /var/lib/sss/pubconf/krb5.include.d/
     
     [logging]
      default = FILE:/var/log/krb5libs.log
      kdc = FILE:/var/log/krb5kdc.log
      admin_server = FILE:/var/log/kadmind.log
     
     [libdefaults]
      default_realm = ADDOMAIN1.COM
      dns_lookup_realm = false
      dns_lookup_kdc = true
      ticket_lifetime = 24h
      renew_lifetime = 7d
      forwardable = true
     
     ...

6. Modify /etc/sssd/sssd.conf to include information about all AD domains in use.

   [sssd]
   services = nss, pam
   config_file_version = 2
   domains = addomain1.com, addomain2.com
   
   [domain/addomain1.com]
   id_provider = ad
   access_provider = ad
   krb5_keytab = /etc/addomain1.com.krb5.keytab
   ldap_krb5_keytab = /etc/addomain1.com.krb5.keytab
   ad_server = dc1.addomain1.com
   ad_maximum_machine_account_password_age = 0
   use_fully_qualified_names = true
   default_shell=/bin/bash
   override_homedir=/home/%d/%u
   
   [domain/addomain2.com]
   id_provider = ad
   access_provider = ad
   krb5_keytab = /etc/addomain2.com.krb5.keytab
   ldap_krb5_keytab = /etc/addomain2.com.krb5.keytab
   ad_server = dc2.addomain2.com
   ad_maximum_machine_account_password_age = 0
   use_fully_qualified_names = true
   default_shell=/bin/bash
   override_homedir=/home/%d/%u
   
   [nss]
   
   [pam]

   • For each domain section, specify the path to the Kerberos keytab that corresponds to each domain with the krb5_keytab and ldap_krb5_keytab options.
   • Set ad_maximum_machine_account_password_age = 0 to disable renewing host Kerberos keys.
   • Set use_fully_qualified_names = true to differentiate users from different domains.
   • Set override_homedir = /home/%d/%u so users (%u) from different domains (%d) each receive unique home directories. For example, the home directory for user linuxuser@addomain1.com is /home/addomain1.com/linuxuser.

7. SSH retrieves host keys from the system keytab and provides single sign-on functionality through GSSAPI/Kerberos. If you would like to use single sign-on, copy all current Kerberos host keys to the /etc/kbr5.keytab system keytab.

   # ktutil
   ktutil:  rkt /etc/addomain1.com.krb5.keytab
   ktutil:  rkt /etc/addomain2.com.krb5.keytab
   ktutil:  wkt /etc/krb5.keytab

8. Restart and enable the SSSD service.

   # systemctl restart sssd
   # systemctl enable sssd

Verification steps

1. Display user details for users from each AD domain:

   # id administrator@addomain1.com
   uid=1240800500(administrator@addomain1.com) gid=1240800513(domain users@addomain1.com) groups=1240800513(domain users@addomain1.com),1240800512(domain admins@addomain1.com),1240800518(schema admins@addomain1.com),1240800520(group policy creator owners@addomain1.com),1240800572(denied rodc password replication group@addomain1.com),1240800519(enterprise admins@addomain1.com)
   
   # id administrator@addomain2.com
   uid=1013800500(administrator@addomain2.com) gid=1013800500(administrator@addomain2.com) groups=1013800500(administrator@addomain2.com),1013800513(domain users@addomain2.com)

2. Log in as a user from each domain and verify the correct home directory is created for the user.

   # ssh administrator@addomain1.com@localhost
   administrator@addomain1.com@localhost's password:
   Creating directory '/home/addomain1.com/administrator'.
   
   $ pwd
   /home/addomain1.com/administrator

   # ssh administrator@addomain2.com@localhost
   administrator@addomain2.com@localhost's password:
   Creating directory '/home/addomain2.com/administrator'.
   
   $ pwd
   /home/addomain2.com/administrator

Procedure

1. Grant access to all users:

   # realm permit --all

2. Grant access to specific users:

   $ realm permit aduser01@example.com
   $ realm permit 'AD.EXAMPLE.COM\aduser01'

Verification steps

1. Use SSH to log in to the server as the aduser01@example.com user:

   $ ssh aduser01@example.com@server_name
   [aduser01@example.com@server_name ~]$

2. Use the ssh command a second time to access the same server, this time as the aduser02@example.com user:

   $ ssh aduser02@example.com@server_name
   Authentication failed.

Procedure

1. Deny access to all users within the domain:

   # realm deny --all

   This command prevents realm accounts from logging into the local machine. Use realm permit to restrict login to specific accounts.

2. Verify that the domain user’s login-policy is set to deny-any-login:

   [root@replica1 ~]# realm list
   example.net
     type: kerberos
     realm-name: EXAMPLE.NET
     domain-name: example.net
     configured: kerberos-member
     server-software: active-directory
     client-software: sssd
     required-package: oddjob
     required-package: oddjob-mkhomedir
     required-package: sssd
     required-package: adcli
     required-package: samba-common-tools
     login-formats: %U@example.net
     login-policy: deny-any-login

3. Deny access to specific users by using the -x option:

   $ realm permit -x 'AD.EXAMPLE.COM\aduser02'